Telegram Mini Apps are web pages opened in a WebView with Telegram’s clothes on. They power wallets, tap games, swap bots and “cloud mining”. Because the chrome looks native, people assume Telegram reviewed the money path. Usually a third-party team did the coding; the messenger only hosts the window.
In August 2026 Andrea Ciccotelli, Federico Zappone and Roberto Di Pietro published TENET: Telegram Mini App (in)security (arXiv). Their tool screened a popularity-weighted sample; of 37 apps fully analysed, 30 showed flaws: recovery phrases or keys in plaintext, encryption that was easy to reverse, or long-lived session tokens that could be replayed. Even Telegram’s official Wallet briefly exposed a DeFi recovery phrase in local storage; after disclosure that issue was fixed, and Telegram added SecureStorage (Keychain / Keystore) alongside ordinary DeviceStorage. That does not force every third-party Mini App to use the safe API.
A bug is not the same as a drainer. Drainers are built to steal; a sloppy wallet may be earnest and still leak seeds to malware that reads local files. For you the empty balance looks the same. Never type a seed phrase into a Mini App that arrived from an ad. Keep experiment money on a throwaway address, update Telegram, and treat every in-chat wallet like an unknown website.
If funds already moved after a Mini App or signed approval, start at Get help. Telegram “recovery” desks: Fake recovery.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.